Step up authentication is an extra identity check triggered when a user tries to do something more sensitive than routine account access. A bank may accept a low risk login, then ask for a stronger check before a new payee is added, a large transfer is sent, or profile details are changed.
This matters because trust can change during a session. Entersekt helps financial institutions match the level of authentication to the risk of the action, not only to the moment of login. This article explains how step up authentication works, where it fits in banking and payments, and what separates it from static MFA.
Step up authentication is a risk based control that raises the assurance level for a specific action. The user is already signed in or partly verified, but the action being attempted calls for stronger proof.
OWASP describes step up authentication as reauthentication or an added factor before sensitive functionality is allowed. NIST also recognizes that a session can be raised to a higher authentication assurance level when a higher level is needed.
A bank should trigger step up authentication when the risk of the action is higher than the risk of ordinary account access. Good examples include large transfers, a new beneficiary, contact detail changes, device enrollment, credential reset, and security setting changes.
The same principle applies in payments. Under strong customer authentication rules, extra checks may be needed when a payer accesses an account online, starts an electronic payment, or takes a remote action that could carry fraud risk.
Step up authentication works by combining policy, context, and a stronger proof of identity. First, the system classifies the action. Next, it reviews signals such as device history, geolocation, user behavior, transaction value, and channel. Then it either lets the action proceed, asks for a stronger check, or blocks the action.
The stronger check can take several forms. It may be a device bound cryptographic check, a biometric activated credential, a secure out of band confirmation, or transaction signing tied to the exact payment or change request.
Context Aware Authentication shows why this matters. If the user is on a known device and the action matches normal behavior, the bank may keep the journey light. If the device, behavior, or action changes, the bank can raise the requirement in real time.
Step up authentication and MFA are related, but they are not the same thing. MFA describes the use of more than one factor. Step up authentication describes when and why a stronger check is triggered.
You can run MFA at every login and still have poor risk control. You can also use step up logic to call for a stronger factor only when risk rises. In practice, many banks use MFA as one part of a broader step up strategy.
This is also why static rules age badly. Authentication Advisor focuses on risk intelligence so the bank can decide when to challenge, when to ask for more proof, and when to let a trusted action continue.
Effective step up authentication is bound to the action being approved. If a customer approves a transfer, that approval should apply to that transfer only. OWASP specifically warns against step up controls that are not tied to the action because an attacker may reuse the approval for something else.
Server side enforcement matters too. A prompt shown only in the app is not enough if the server will still execute the action without verified proof. NIST guidance also points to phishing resistant cryptographic methods when stronger assurance is needed.
Context aware authentication adds another layer of value because it looks at who is acting, what they are trying to do, and whether the behavior fits the moment.
Step up authentication is common anywhere a session can be hijacked, misused, or socially engineered after login. In retail and business banking, that usually includes money movement and account maintenance.
| Use case | Why step up may be needed |
|---|---|
| New payee or beneficiary | Raises fraud risk and may need explicit confirmation |
| Large or unusual transfer | Value, velocity, or destination may differ from normal behavior |
| Profile or contact change | Attackers often change details before taking over the account |
| Device registration | A new device can alter the trust model for later actions |
| Credential recovery | Recovery flows are a common path to account takeover |
| Card or wallet management | High impact actions can enable misuse after the change |
For a broader foundation, customer authentication covers the role of identity checks across digital channels, while step up authentication focuses on the moments when ordinary assurance is no longer enough.
Step up authentication helps stop more than stolen credential attacks. It can also reduce harm in social engineering scams where the real customer is present but under pressure, misled, or manipulated.
That is why context matters. A request may be coming from the right person on the right device, yet the surrounding signals can still look wrong. The ATO prevention shift: from identity to intent captures this change clearly. The question is no longer only who the user is. The question is also whether the action makes sense for that user at that moment.
Banks should start by classifying actions by risk, then mapping each action to the level of assurance it needs. FFIEC guidance supports this risk based approach and calls for enhanced authentication controls for higher risk transactions and users.
It also helps to support more than one method so the bank can serve different customer groups and channels. The FCA has said firms may need several authentication methods, including methods that do not rely on a mobile phone.
Finally, step up events should be logged, monitored, and tuned. If too many low risk actions trigger a challenge, customers face unnecessary delay. If too few high risk actions trigger a challenge, fraud gaps remain.
Step up authentication gives you a way to raise assurance only when the action calls for it. That makes it a core control for digital banking, payments, account protection, and scam defense.
Used well, it supports a simple idea. Routine activity should stay easy for trusted users. Higher risk activity should face stronger proof that is tied to the exact action, informed by context, and enforced at the server.
Not always. Step up authentication often includes reauthentication, but the purpose is to raise assurance for a sensitive action. Entersekt helps banks connect that extra check to risk signals so the challenge matches the moment.
Step up authentication is a risk based method. Strong customer authentication is a regulatory requirement in certain payment contexts. Entersekt supports banks that need to apply stronger checks for high risk actions while protecting digital journeys.
Yes. In fact, that is one of its main uses. OWASP highlights sensitive actions that happen after login, and Entersekt helps banks review device, behavior, and transaction context before those actions are approved.
Not by value alone. Amount is one signal, but risk also depends on payee status, device trust, behavior, channel, and recent account events. A better approach reviews the full context before deciding.
Several methods can be used, including biometrics tied to a device, cryptographic credentials, secure out of band checks, and transaction signing. NIST guidance gives the strongest weight to phishing resistant cryptographic methods when higher assurance is needed.
Sources: OWASP MASWE 0023, NIST SP 800 63B, FFIEC interagency guidance.